How to Stop Discord Impersonation Scams Before They Reach Your Members

The moment it goes wrong

A member asks a question publicly. Minutes later a direct message arrives, apparently from your support lead, with the right avatar and a helpful tone, offering to resolve it privately. It asks for a credential or a payment.

Nothing available to that member disproves it. Exact usernames are unpublished, the profile looks right, and the timing feels like good service rather than someone watching the channel.

The member is not being reckless. They were handed no way to verify.

Reading the early signs

The fourth row is the costly one. Closed direct messages protect the member and simultaneously remove the private route your own team relies on for sensitive conversations.

Why removal alone fails

A ban takes a minute. So does the next account. The attacker can repeat that cycle through your overnight window indefinitely.

Every removal also happens after contact, which means the damage precedes the response. Cleanup is necessary and it is not a defence.

Three proofs a member can use in ten seconds

A distinct staff role shown as its own group in the member list. A pinned roster listing exact usernames rather than display names, since display names are exactly what gets copied. A line in the server description pointing at that roster, so a thirty second old member can still find it.

Three proofs rather than one, because an impersonator will target whichever single proof you depend on, and an account with no permissions cannot fake all three simultaneously.

One place links live

One locked channel, pinned, as the sole source of every link your team publishes. Then the rule that makes it work: any link appearing anywhere else is unverified, including one that looks like it came from staff.

This protects members precisely when they are most exposed, during launches and announcements, when unfamiliar links are expected and scepticism is lowest.

The rule collapses the first time a real staff member drops a convenient link into general chat. Hold the line internally or the channel means nothing.

The promise, repeated until boring

We will never message you first.
We will never ask for a password, a recovery
phrase, or a payment in a direct message.

Onboarding, rules, pinned roster, and after every incident. Repetition is the mechanism, because the promise only protects members who already knew it before the message arrived.

It disciplines your team too. If staff genuinely never initiate, then any unsolicited staff message is provably fake and the member needs no judgement at all.

Friction at the entrance

A minimum account age before posting or messaging. A verification step before new accounts can message members. A watch list for usernames closely resembling your team's, flagged for human review instead of an automatic welcome.

The watch list is the least used and the most valuable. A username one character off a moderator's is never accidental, and catching it on join means acting before contact rather than after.

Reporting that people actually use

One obvious action, one obvious place, ten seconds. Anything longer and most members will block quietly and you will never know.

Give moderators one written response line so the reply reads identically on every shift. An inconsistent response leaves members unsure which answer was genuine, which is the same confusion the attacker was exploiting.

Say it publicly

Teams avoid the public notice because it feels like advertising a failure. It is the single highest leverage action available, because it inoculates everyone who reads it against the next twenty attempts.

Silence after an incident protects the brand for a week and costs the community its next twenty members.

The rest of the safety system

This is the identity layer. Around it sit the automated gate that absorbs volume at the door, moderator staffing across time zones, escalation paths for incidents needing a senior decision, and an incident log that turns isolated events into a pattern worth designing against.

What identity work does is remove the precondition. Impersonation needs a member who cannot check. Publish the proofs, centralise the links, hold the promise, and the attempt stops being worth the attacker's minute.

Verification beats vigilance, because verification works when nobody is paying attention. More at danieljeong.org.